Overview

overview

10

Static

static

10

beta_v1.0.4.exe

windows7-x64

10

beta_v1.0.4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    beta_v1.0.4.exe

  • Size

    348KB

  • Sample

    241125-pt6vxswrft

  • MD5

    f289d19ee6059d4e46e41cfd359ee221

  • SHA1

    9cf505b34b9b9e26d7f5827f57f6eae80fedd480

  • SHA256

    5e6dd4da06fc90ffca3baf93dd667d0a09a6d7a1fc449936c9a3d85e7187cb46

  • SHA512

    6203aaa554068a3d105f71147948a5391142e5cf897461a8c6de7908790dca3902624fff02a4b13e497be8f67f85e9fd5b03844805828ffc1617b12c5fd78652

  • SSDEEP

    6144:77NHXf500MirO57lIItbtUWUebCWauali:Hd50/5b/Oeb6uEi

Score
10/10
quasarbetatestdiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

betatest

C2

94.216.15.177:4782

Mutex

QSR_MUTEX_2Yw0HjfVLWnEPRGNYg

Attributes
  • encryption_key

    SCsaUUCljEt68jZA9Hzs

  • install_name

    betatester_6-24.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    betatest

  • subdirectory

    SubDir

Targets

    • Target

      beta_v1.0.4.exe

    • Size

      348KB

    • MD5

      f289d19ee6059d4e46e41cfd359ee221

    • SHA1

      9cf505b34b9b9e26d7f5827f57f6eae80fedd480

    • SHA256

      5e6dd4da06fc90ffca3baf93dd667d0a09a6d7a1fc449936c9a3d85e7187cb46

    • SHA512

      6203aaa554068a3d105f71147948a5391142e5cf897461a8c6de7908790dca3902624fff02a4b13e497be8f67f85e9fd5b03844805828ffc1617b12c5fd78652

    • SSDEEP

      6144:77NHXf500MirO57lIItbtUWUebCWauali:Hd50/5b/Oeb6uEi

    Score
    10/10
    quasarbetatestdiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks